import re
from collections import defaultdict
import os
fun_cheak = set()
syscall_count = defaultdict(int)
syscalls = {
        "recvfrom", "write", "ioctl", "read", "sendto", "dup", "writev", "pread", "close",
        "socket", "bind", "connect", "mkdir", "access", "chmod", "open", "rename", "fchown32",
        "unlink", "pwrite", "umask", "lseek", "fcntl", "recvmsg", "sendmsg", "epoll", "dup2",
        "fchown", "readv", "chdir"
    }

def parse_logs(log_file_path):
    fun_set = []
    log_entries = {}
    with open(log_file_path, 'r') as file:
        for line in file:
            # 跳过包含 "exited with" 和 "killed by" 的行
            if "exited with" in line or "killed by" in line:
                continue
            """
            匹配未完成的调用
            PID TIMESTAMP FUNCTION(PARAMS <unfinished ...> 
            """
            unfinished_match = re.match(r'(\d+)\s+\d+\.\d+\s+(\w+)\((.*?)(<unfinished \.\.\.>)', line)
            """
            匹配恢复的调用
            PID TIMESTAMP <... FUNCTION resumed> PARAMS [<unfinished ...>] ) = RETURN_VALUE [ (ERROR) ]
            """
            resumed_match = re.match(r'(\d+)\s+\d+\.\d+\s+<\.\.\. (\w+) resumed> (.*?)(<unfinished \.\.\.>)?\)? = (.*)', line)
            """ 
            匹配完整的调用
            PID TIMESTAMP FUNCTION(PARAMS) = RETURN_VALUE [ (ERROR) ]66
            """
            complete_match = re.match(r'(\d+)\s+\d+\.\d+\s+(\w+)\((.*?)\) = (.*)', line)

            if unfinished_match:
                pid, func, params, _ = unfinished_match.groups()
                func =re.sub(r'[^a-zA-Z]', '', func)
                if func in syscalls:
                    if pid not in log_entries:
                        log_entries[pid] = []
                    log_entries[pid].append((func, params))

            elif resumed_match:
                pid, func, params, unfinished, retval = resumed_match.groups()
                func =re.sub(r'[^a-zA-Z]', '', func)
                if unfinished:
                    continue
                if func in syscalls:
                    syscall_count[func] += 1
                    if pid in log_entries and log_entries[pid]:
                        func_prev, params_prev = log_entries[pid].pop()
                        params = f"{params_prev}{params}"
                        fun_set.append((pid, func, params))  # 使用元组来存储信息
                    
            elif complete_match:
                pid, func, params, retval = complete_match.groups()
                func =re.sub(r'[^a-zA-Z]', '', func)
                if func in syscalls:
                    syscall_count[func] += 1
                    params = f"{params}"
                    fun_set.append((pid, func, params))  # 使用元组来存储信息
    return fun_set


directory = '/home/chenjiaxiong/mount/dataset/malware'

for filename in os.listdir(directory):
    fs = []
    file_path = os.path.join(directory, filename)
    if os.path.isfile(file_path):
        fs= parse_logs(file_path)
        output_file_path = f'/home/chenjiaxiong/mount/wash_log/malware/{filename}'
        with open(output_file_path, 'w') as output_file:
            for entry in fs:
                output_file.write(f"PID: {entry[0]}, Function: {entry[1]}, Params: {entry[2]}\n")
